patriksimek vm2
77 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-100723 | < 3.12.2 | vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-100722 | < 3.12.2 | vm2 before 3.12.2 Host Process Termination via Construct Trap | HIGH 8.9 | 0.3 % | ||
| CVE-2026-100721 | < 3.12.2 | vm2 before 3.12.2 Authorization Bypass via Custom Resolver | CRITICAL 9.5 | 0.6 % | ||
| CVE-2026-93606 | < 3.12.1 | vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species | CRITICAL 10.0 | 0.7 % | ||
| CVE-2026-93605 | < 3.12.1 | vm2 NodeVM before 3.12.1 Remote Code Execution via child_process | CRITICAL 10.0 | 0.7 % | ||
| CVE-2026-93604 | < 3.12.1 | vm2 3.11.8 Sandbox Escape via crypto.setFips | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-93603 | < 3.12.1 | vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function | CRITICAL 10.0 | 0.7 % | ||
| CVE-2026-92963 | < 3.11.2 | vm2 before 3.11.2 Information Disclosure via Internal State | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-92962 | < 3.11.4 | vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js | LOW 2.1 | 0.2 % | ||
| CVE-2026-92961 | < 3.11.6 | vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass | HIGH 8.7 | 0.5 % | ||
| CVE-2026-92960 | < 3.11.6 | vm2 before 3.11.6 Process-wide State Exposure via os and dns | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-92959 | < 3.11.8 | vm2 before 3.11.8 allowAsync Bypass via Promise Thenable | HIGH 7.1 | 0.4 % | ||
| CVE-2026-92958 | < 3.11.7 | vm2 before 3.11.7 Denylist Bypass via fs/promises | HIGH 8.4 | 0.4 % | ||
| CVE-2026-92957 | < 3.11.7 | vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-92956 | 3.10.1 – < 3.11.7 | vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming | CRITICAL 10.0 | 0.6 % | ||
| CVE-2026-92955 | < 3.11.8 | vm2 before 3.11.8 Sandbox Escape via NodeVM | CRITICAL 10.0 | 0.7 % | ||
| CVE-2026-92954 | 3.10.0 – < 3.11.8 | vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-92953 | 3.11.0 – < 3.11.8 | vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-92952 | 3.11.4 – < 3.11.7 | vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass | HIGH 8.9 | 0.5 % | ||
| CVE-2026-92951 | < 3.11.7 | vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver | CRITICAL 9.4 | 0.5 % | ||
| CVE-2026-92950 | < 3.11.7 | vm2 before 3.11.7 Sandbox Escape via CLI require | CRITICAL 9.3 | 0.2 % | ||
| CVE-2026-92949 | 3.9.6 – < 3.11.7 | vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-92948 | 3.9.6 – < 3.11.7 | vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test | CRITICAL 9.4 | 0.7 % | ||
| CVE-2026-92947 | < 3.11.7 | vm2 before 3.11.7 Memory Disclosure via Buffer Pool | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-92946 | < 3.11.7 | vm2 before 3.11.7 Remote Code Execution via require.external | CRITICAL 10.0 | 0.9 % | ||
| CVE-2026-92945 | < 3.11.7 | vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching | LOW 2.3 | 0.3 % | ||
| CVE-2026-92944 | 3.10.2 – < 3.11.7 | vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector | CRITICAL 9.3 | 0.8 % | ||
| CVE-2026-92942 | < 3.11.7 | vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry | HIGH 8.7 | 0.5 % | ||
| CVE-2026-92941 | 3.11.3 – < 3.11.7 | vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation | CRITICAL 10.0 | 0.3 % | ||
| CVE-2026-92940 | 3.11.3 – < 3.11.7 | vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-92939 | 3.11.3 – < 3.11.7 | vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine | CRITICAL 9.4 | 0.6 % | ||
| CVE-2026-92938 | 3.11.3 – < 3.11.7 | vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite | CRITICAL 9.4 | 0.6 % | ||
| CVE-2026-92937 | 3.11.6 – < 3.11.7 | vm2 3.11.6 Remote Code Execution via Promise call/apply | CRITICAL 10.0 | 1.0 % | ||
| CVE-2026-92936 | 3.11.0 – < 3.11.7 | vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-92935 | 3.11.4 – < 3.11.7 | vm2 NodeVM Remote Code Execution via Array-Shaped Require | CRITICAL 9.5 | 0.7 % | ||
| CVE-2026-92934 | < 3.11.8 | vm2 before 3.11.8 Sandbox Escape RCE via AggregateError | CRITICAL 9.5 | 0.8 % | ||
| CVE-2026-92933 | < 3.11.8 | vm2 before 3.11.8 Information Disclosure via util.getCallSites | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-47683 | < 3.11.6 | vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike | HIGH 8.7 | 0.5 % | ||
| CVE-2026-47686 | < 3.11.6 | vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-47698 | < 3.11.6 | vm2: Sandbox Breakout Using Dangerous Host Proto Mutators | CRITICAL 9.8 | 1.0 % | ||
| CVE-2026-47141 | < 3.11.4 | vm2: NodeVM observability builtins leak host process and HTTP request data | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-47210 | < 3.11.4 | vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass | CRITICAL 9.8 | 1.7 % | ||
| CVE-2026-47208 | < 3.11.4 | vm2: Sandbox Breakout Using Promise Species | CRITICAL 10.0 | 1.0 % | ||
| CVE-2026-47140 | < 3.11.4 | vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution | CRITICAL 10.0 | 1.0 % | ||
| CVE-2026-47139 | < 3.11.4 | vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server | HIGH 8.6 | 0.4 % | ||
| CVE-2026-47137 | < 3.11.4 | vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE | CRITICAL 10.0 | 0.4 % | ||
| CVE-2026-47135 | < 3.11.4 | vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks | HIGH 8.7 | 0.3 % | ||
| CVE-2026-47131 | < 3.11.4 | vm2: Sandbox Escape | CRITICAL 10.0 | 0.8 % | ||
| CVE-2026-47209 | < 3.11.4 | vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain | HIGH 8.6 | 0.3 % | ||
| CVE-2026-44005 | >= 3.9.6, < 3.11.0 | vm2: Sandbox escape | CRITICAL 10.0 | 0.8 % | ||
| CVE-2026-45411 | < 3.11.3 | vm2: Sandbox Breakout Using Async Generator | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-44009 | < 3.11.2 | vm2: Sandbox Breakout Through Null Proto Exception | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-44008 | < 3.11.2 | vm2: Snabox breakout via `neutralizeArraySpeciesBatch` | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-44007 | < 3.11.1 | vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution | CRITICAL 9.9 | 1.0 % | ||
| CVE-2026-44006 | < 3.11.0 | vm2: Sandbox Escape | CRITICAL 10.0 | 0.8 % | ||
| CVE-2026-44004 | < 3.11.0 | vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass) | HIGH 8.6 | 0.4 % | ||
| CVE-2026-44003 | < 3.11.0 | vm2: Transformer Fast-Path Bypass Exposes Internal State Variable | MEDIUM 5.8 | 0.2 % | ||
| CVE-2026-44002 | < 3.11.0 | vm2: Host File Path Disclosure via Stack Trace Information Leak | MEDIUM 5.8 | 0.2 % | ||
| CVE-2026-44001 | < 3.11.0 | vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) | HIGH 8.6 | 0.4 % | ||
| CVE-2026-44000 | < 3.11.0 | vm2: sandbox boundary bypass via host Promise resolution preserving host object identity | HIGH 7.2 | 0.2 % | ||
| CVE-2026-43999 | < 3.11.0 | vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape | CRITICAL 9.9 | 1.0 % | ||
| CVE-2026-43998 | 3.10.5 | vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape | HIGH 8.5 | 0.7 % | ||
| CVE-2026-43997 | < 3.11.0 | vm2: Sandbox Escape | CRITICAL 10.0 | 1.0 % | ||
| CVE-2026-26956 | = 3.10.4 | vm2: WASM Sandbox Escape (Node 25 only) | CRITICAL 9.8 | 1.1 % | ||
| CVE-2026-26332 | < 3.11.0 | vm2: Sandbox Escape | CRITICAL 10.0 | 0.7 % | ||
| CVE-2026-24781 | < 3.11.0 | vm2: Sandbox Breakout Through Inspect | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-24120 | < 3.10.5 | vm2: Sandbox Breakout Through Promise Species | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-24118 | < 3.11.0 | VM2 Sandbox Breakout Through __lookupGetter__ | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-22709 | < 3.10.2 | vm2 has a Sandbox Escape | CRITICAL 10.0 | 1.3 % | ||
| CVE-2023-37903 | <= 3.9.19 | Sandbox Escape in vm2 | CRITICAL 10.0 | 4.2 % | ||
| CVE-2023-37466 | <= 3.9.19 | vm2 Sandbox Escape vulnerability | CRITICAL 10.0 | 3.9 % | ||
| CVE-2023-32314 | < 3.9.18 | Sandbox Escape | CRITICAL 10.0 | 8.1 % | ||
| CVE-2023-32313 | < 3.9.18 | Inspect method manipulation in vm2 | MEDIUM 5.3 | 0.8 % | ||
| CVE-2023-30547 | < 3.9.17 | Sandbox Escape in vm2 | CRITICAL 10.0 | 73 % | ||
| CVE-2023-29199 | < 3.9.16 | vm2 Sandbox escape vulnerability | CRITICAL 10.0 | 3.9 % | ||
| CVE-2023-29017 | < 3.9.15 | vm2 Sandbox Escape vulnerability | CRITICAL 10.0 | 63 % | ||
| CVE-2022-36067 | < 3.9.11 | vm2 vulnerable to Sandbox Escape before v3.9.11 | CRITICAL 10.0 | 48 % |